If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

Hybrid View

What to do about false positives?

I had my first false positive today: the file nvappbar.exe was identified as the virus Email-wWorm.Win32.Small.f.
In fact this is a legitimate nVidia file (the nView Toolbar) and has already been identified as a false positive on the Kaspersky forum, which says something will be done about it soon.My question is, what do I do about it in the meantime?
If I put it on the list of exceptions ZASS lists it not by file name and path,
but by the name of the virus which it is not--this means if I add it to exceptions that virus--the real one--can get in, doesn't it?
So how to I get ZASS to leave nvappbar.exe alone while still detecting real viruses?

Re: What to do about false positives?

<BLOCKQUOTE><HR>PhoenixGTR wrote:
So how to I get ZASS to leave nvappbar.exe alone while still detecting real viruses?

<HR></BLOCKQUOTE>Yep, its not possible to exclude "on access" only "on demand" (scan targets)Usually false positives are fixed in a matter of hours.... so you should not leave excluded that malware longer than 6/7 hours.The probability of getting infected by that virus within hundreds of viruses around I beleive is very limited, but still it would be nice to have exclusion by file name!Fax

Re: What to do about false positives?

Thanks for the speedy reply, fax.
I'll delete it from the list of exceptions when I log off today and then try again tomorrow.
Which do you think is the best setting for my Virus Management treatment options in the meantime:1) leave it on the recommended setting and remove
the nVidia file
from quarantine if it gets &quot;caught&quot; again, or2) change the setting to &quot;try to repair, and alert me if repair fails&quot; or &quot;alert me--do not treat automatically&quot;?